PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_fopen

file system operations fopen

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#101Wordfence Security – Firewall, Malware Scan, and Login Security211,5922,9735m+Output is not escaped
#102WP Compress – Instant Performance & Speed Optimization213,3493,21810k+Non Singular String Literal Domain
#103WP-Lister Lite for eBay216,6975,1292k+Output is not escaped
#104WP phpMyAdmin214,5286,43550k+Missing Arg Domain
#105wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin211,8111,43270k+Output is not escaped
#106WebTotem Security211,110213900Text Domain Mismatch
#10712 Step Meeting List22156593900Non-prefixed global variable
#108Ajax Load More – Infinite Scroll, Load More, & Lazy Load2264159540k+Unsafe printing function
#109All-in-One Video Gallery229112,89220k+Non-prefixed global variable
#110Shortcodes and extra features for Phlox theme2241342690k+Output is not escaped
#111ANAC XML Bandi di Gara22294244600Output is not escaped
#112Backup Bolt225801,313900Non-prefixed global variable
#113Borderless – Addons and Templates for Elementor224381,3885k+Non-prefixed global variable
#114Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots221,6072,01810k+Direct Query
#115Better WordPress Minify224124848k+Non Singular String Literal Domain
#116Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8581,27050k+Text Domain Mismatch
#117Code Profiler – WordPress Performance Profiling and Debugging Made Easy222654008k+Non-prefixed global variable
#118Accept PayPal Payments using Contact Form 722359127600Text Domain Mismatch
#119RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login223,6545,0618k+Non-prefixed global variable
#120WP Customer Area223,30894110k+Text Domain Mismatch
#121Database Access with Adminer229832,5531k+Non-prefixed global variable
#122Directorist: AI-Powered Business Directory, Listings & Classified Ads224432,12920k+Non-prefixed global variable
#123Download Manager222,2901,301100k+Output is not escaped
#124Dynamic QR Code – generator222382086k+Missing direct file access protection
#125E2Pdf – Export Pdf Tool for WordPress221,07583610k+Unsafe printing function
#126easyReservations225,3072,480800Text Domain Mismatch
#127Events Manager – Calendar, Bookings, Tickets, and more!224,7225,62170k+Output is not escaped
#128File Manager Pro – Filester22565391100k+Request data is not unslashed
#129Finale Lite – Sales Countdown Timer & Discount for WooCommerce221,0314514k+Output is not escaped
#130FireBox Popups – Increase Sales and Grow Your Email List221538127k+Non-prefixed global variable
#131Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder22409236700k+Text Domain Mismatch
#132Five Star Restaurant Menu and Food Ordering227526095k+Output is not escaped
#133FunnelKit Payment Gateway for Stripe WooCommerce2224432120k+Input is not sanitized
#134GeoDirectory – WP Business Directory Plugin and Classified Listings Directory224,4663,97210k+Output is not escaped
#135Anti-Malware Security and Brute-Force Firewall22544965100k+Output is not escaped
#136Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms221,03772220k+Unsafe printing function
#137Hesabfa Accounting22467718400Text Domain Mismatch
#138Heureka22557254400Exception output is not escaped
#139Csomagpontok és Címkék WooCommerce-hez222,0017697k+Text Domain Mismatch
#140Insert or Embed Articulate Content into WordPress226591,4372k+Non-prefixed global variable
#141Számlázz.hu integráció WooCommerce-hez221,1694607k+Text Domain Mismatch
#142InfiniteWP Client222,2861,812200k+Exception output is not escaped
#143Import WP – Export and Import CSV and XML files to WordPress225803304k+Exception output is not escaped
#144Jim Soft Swiss QR Invoice22263392400Non-prefixed global variable
#145LearnPress – WordPress LMS Plugin for Create and Sell Online Courses222,3463,34170k+Non-prefixed global variable
#146Mail Baby SMTP22385699600SQL query is not prepared
#147MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.222,6192,45310k+Output is not escaped
#148Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider22207323500k+Non-prefixed global variable
#149Moloni229023562k+Missing Arg Domain
#150Motors – Car Dealership & Classified Listings Plugin225,3405,9589k+Text Domain Mismatch